CVE-2026-87675 in Fabric OS
Summary
by MITRE • 10/08/2026
An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host strings, and filenames directly to an internal utility script without sufficient character set validation. Because the local utility fails to sanitize shell metacharacters before processing them in a system shell command, a malicious or compromised configuration file can cause arbitrary operating system commands to be executed on a remote local switch when an administrator initiates a configuration download.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified involves a critical OS command injection flaw within the configuration management subsystem of Brocade Fabric OS versions prior to 9.2.2d and in versions ranging from 10.0.0 through 10.0.0a1. This security defect is rooted in the handling of user-supplied input during the process of downloading configurations, where the system fails to adequately validate or sanitize data before passing it to underlying operating system utilities. The core technical flaw lies in the management daemon's behavior when relaying configuration parameters, specifically relay host strings and filenames, directly to an internal utility script. This script subsequently executes these inputs within a shell command context without performing sufficient character set validation or escaping of special characters. Consequently, if an attacker can influence the input data—such as by providing a maliciously crafted configuration file during a download operation—they can inject arbitrary operating system commands that will be executed with the privileges of the local switch's management process.
From a technical perspective, this vulnerability is classified under CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The attack vector typically requires interaction with the network management interface, where an administrator or authorized user initiates a configuration download from a potentially compromised source. By embedding shell metacharacters such as semicolons, pipes, or backticks within filenames or relay host strings, an attacker can break out of the intended command context and execute arbitrary commands on the underlying operating system. This exploitation path aligns with ATT&CK technique T1059 Command and Scripting Interpreter, specifically leveraging OS-level shells to achieve remote code execution. The severity is heightened by the fact that Brocade Fabric OS devices often serve as critical infrastructure components in data center networks, managing storage area network traffic and inter-switch links.
The operational impact of this vulnerability is severe, potentially leading to full compromise of the affected switch. An attacker who successfully exploits this flaw can gain unauthorized access to the device's operating system, allowing them to modify configurations, exfiltrate sensitive network topology information, install persistent backdoors, or pivot further into the internal network. Since these switches often handle critical storage traffic, compromising a fabric could disrupt business operations and lead to significant data loss or service downtime. The vulnerability affects both older legacy systems running versions before 9.2.2d and newer releases up through 10.0.0a1, indicating that the flaw persisted across multiple major release cycles until it was addressed in subsequent patches.
To mitigate this risk, organizations must immediately apply the latest available firmware updates from Brocade for their affected Fabric OS versions. For systems running version 9.x, upgrading to at least version 9.2.2d is required, while users of the 10.0.0 series should upgrade beyond version 10.0.0a1. In environments where immediate patching is not feasible due to operational constraints, administrators should implement strict network segmentation to limit access to the management interfaces of these switches and enforce rigorous validation on any configuration files imported into the fabric. Additionally, monitoring for unusual outbound connections or unexpected process executions from switch management processes can aid in detecting potential exploitation attempts before significant damage occurs.